SOA-C02 Practice Test 42 — 15 Questions

Question 1

A SysOps administrator manages a fleet of Amazon EC2 instances. The administrator needs to identify underutilized instances and receive recommendations for instance type changes to reduce costs. Which AWS service should be used to provide these rightsizing recommendations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the correct service because it uses machine learning to analyze historical utilization metrics (CPU, memory, network, and storage) of EC2 instances and generates rightsizing recommendations, including instance type changes, to reduce costs and improve performance. It directly addresses the need to identify underutilized instances and provide actionable recommendations for cost optimization.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch Dashboard

Question 2

A company runs a REST API on Amazon EC2 instances behind an Application Load Balancer. The SysOps administrator needs to monitor the API endpoint from multiple geographic locations and receive an alarm if the p90 latency exceeds 2 seconds for two consecutive checks. The solution must use AWS managed services and not require custom code running on EC2. Which approach should the administrator use?

Accepted Answer

Set up Amazon CloudWatch Synthetics canaries to run from multiple AWS Regions and publish custom metrics. Create a CloudWatch alarm on the p90 latency metric.. Amazon CloudWatch Synthetics canaries are AWS-managed Node.js scripts that run on a schedule to monitor endpoints from multiple AWS Regions, capturing metrics like duration and latency. By configuring canaries to report p90 latency as a custom metric, you can create a CloudWatch alarm that triggers when p90 exceeds 2 seconds for two consecutive data points, meeting all requirements without custom EC2 code.

Answer

Configure VPC Flow Logs on the Application Load Balancer and use Amazon CloudWatch Logs Insights to query for high-latency requests.

Answer

Enable Amazon CloudWatch RUM (Real User Monitoring) on the client side and create a CloudWatch alarm on the Duration metric.

Answer

Use AWS CloudTrail to log API calls and set a CloudWatch alarm on the event count for errors.

Question 3

A company has multiple on-premises branch offices, each with a site-to-site VPN connection to a single VPC in AWS. The SysOps administrator needs to enable communication between the branch offices using the AWS cloud as a hub. Which configuration should be implemented to achieve this with the least operational overhead?

Accepted Answer

Use dynamic routing (BGP) on all VPN connections and enable route propagation on the virtual private gateway (VGW).. Enabling dynamic routing (BGP) on all VPN connections and propagating routes from the virtual private gateway (VGW) into the VPC route table allows each branch office to learn the CIDR blocks of all other branch offices automatically. This eliminates the need for manual static route entries and ensures that traffic between branch offices is routed through the VPC hub with minimal operational overhead, as BGP handles failover and route updates dynamically.

Answer

Configure static routes in the VPC route table pointing to each VPN connection.

Answer

Create a separate Transit VPC with EC2-based VPN appliances to route traffic between branch offices.

Answer

Place all branch offices in the same IPsec tunnel by configuring identical pre-shared keys.

Question 4

A company's security policy requires that all IAM user passwords must be at least 12 characters long. The SysOps administrator needs to enforce this requirement across the AWS account. Which action should the administrator take?

Accepted Answer

Update the IAM account password policy to require a minimum length of 12 characters.. The IAM account password policy is the native AWS mechanism for enforcing password requirements across all IAM users in an account. By updating this policy to require a minimum length of 12 characters, the administrator ensures that any new or changed password must comply, and existing passwords are not affected until the next change. This is a direct, account-wide setting that requires no additional services or custom logic.

Answer

Create an AWS Config rule to check password length and auto-remediate.

Answer

Enable AWS CloudTrail to monitor for password changes and alert the administrator.

Answer

Attach a service control policy (SCP) that denies IAM user creation if the password is less than 12 characters.

Question 5

A company has an Application Load Balancer (ALB) in the us-east-1 region. Users in Asia report high latency. The SysOps administrator wants to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. Which step is required to integrate Global Accelerator with the ALB?

Accepted Answer

Configure the ALB as an endpoint group in a Global Accelerator accelerator.. AWS Global Accelerator uses the AWS global network to route traffic to the closest edge location, then forwards it over the AWS backbone to the ALB endpoint. To integrate, you must configure the ALB as an endpoint in an endpoint group within the accelerator, which allows Global Accelerator to direct traffic to the ALB based on proximity and health. This reduces latency for users in Asia by minimizing internet hops.

Answer

Create a CloudFront distribution and point it to the ALB as an origin.

Answer

Set up a Route 53 geoproximity routing policy for the ALB.

Answer

Use AWS WAF to allow traffic from Global Accelerator edge locations.

Question 6

A SysOps administrator needs to monitor application logs stored in Amazon CloudWatch Logs for the term 'CRITICAL'. When more than 5 'CRITICAL' entries appear in a 5-minute window, the administrator wants to automatically restart the underlying Amazon EC2 instance. Which solution should the administrator implement?

Accepted Answer

Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an EC2 Reboot Instances action.. CloudWatch Logs metric filters can count occurrences of the term 'CRITICAL' in log data, and a CloudWatch alarm can be configured to trigger an EC2 Reboot Instances action directly when the metric exceeds a threshold of 5 in a 5-minute period. This provides a native, simple, and fully managed solution without requiring additional services like Lambda or Systems Manager.

Answer

Create a CloudWatch Logs metric filter, then a CloudWatch alarm that triggers an AWS Systems Manager Automation document to restart the instance.

Answer

Create a CloudWatch Logs metric filter, then use Amazon CloudWatch Events (Amazon EventBridge) to trigger an AWS Lambda function that restarts the instance.

Answer

Use Amazon CloudWatch Synthetics canary to monitor the logs and automatically stop the instance.

Question 7

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses session stickiness (sticky sessions) to maintain user sessions. The SysOps administrator notices that when instances are replaced during a scale-in or failure event, users lose their session data. The administrator needs to preserve session data across instance failures without losing stickiness benefits. What should the administrator do?

Accepted Answer

Disable sticky sessions on the ALB and configure the application to store session data in an external session store like Amazon ElastiCache for Redis.. It eliminates the dependency on stickiness by storing session data externally in Amazon ElastiCache for Redis. This way, if an instance fails or is scaled in, any other instance can retrieve the session data from the shared cache, preserving the user session. Disabling sticky sessions is necessary because with external storage, stickiness is no longer needed and can cause uneven load distribution.

Answer

Increase the stickiness duration to a very high value so that sessions are not lost during brief interruptions.

Answer

Change the Auto Scaling group to use a larger instance type to handle more sessions per instance, reducing the likelihood of session loss.

Answer

Configure the Auto Scaling group to use a larger minimum size and a lower maximum, so instances are less likely to be terminated.

Question 8

A company runs a batch processing application on Amazon EC2 that runs for 2 hours every night. The workload can tolerate interruptions. Which EC2 purchasing option provides the lowest cost for this use case?

Accepted Answer

Spot Instances. Spot Instances are the correct choice because the workload is fault-tolerant, runs for a fixed 2-hour window nightly, and can tolerate interruptions. Spot Instances offer significant cost savings (up to 90% off On-Demand) by using spare EC2 capacity, which aligns perfectly with a batch job that can be retried if interrupted.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Dedicated Hosts

Question 9

A company uses AWS Organizations and wants to restrict access to S3 buckets based on project tags. The security policy requires that users in the 'DataScientists' group can only access S3 buckets that have the tag 'Project: DataEngineering'. Which IAM policy condition key should the SysOps administrator use in a customer managed policy to enforce this restriction?

Accepted Answer

aws:ResourceTag. The `aws:ResourceTag` condition key is used in IAM policies to control access based on the tags attached to the AWS resource (in this case, an S3 bucket). By specifying `aws:ResourceTag/Project` with a value of `DataEngineering`, the policy ensures that only S3 buckets with that exact tag are accessible to the 'DataScientists' group. This key is evaluated against the resource's tags at the time of the request, making it the appropriate choice for tag-based resource restrictions.

Answer

s3:ExistingObjectTag

Answer

s3:ResourceTag

Answer

iam:ResourceTag

Question 10

A SysOps administrator uses AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance and a security group. The administrator wants to ensure that when the stack is updated, the security group is not accidentally replaced if its properties change. The administrator wants to receive a failure if an update would require replacement of the security group. Which CloudFormation feature should the administrator use?

Accepted Answer

Define a stack policy that denies replacement of the security group resource.. A stack policy can explicitly deny update actions that would replace a resource, such as the security group. By defining a stack policy with a Deny statement for the 'Replace' effect on the security group's logical resource ID, CloudFormation will fail the update if any property change triggers a replacement, preventing accidental deletion and recreation.

Answer

Add a 'DeletionPolicy' attribute set to 'Retain' on the security group resource.

Answer

Add a 'CreationPolicy' attribute to the security group resource.

Answer

Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' on the security group.

Question 11

A company runs an e-commerce application on Amazon EC2 instances behind an Auto Scaling group. The application has a predictable baseline load from 8 AM to 8 PM daily and low load overnight. The SysOps administrator wants to optimize costs while ensuring sufficient capacity for the baseline load. Which purchasing option and scaling strategy should the administrator use?

Accepted Answer

Use Reserved Instances for the predicted baseline and On-Demand for any unexpected spikes.. Reserved Instances provide a significant discount (up to 72%) over On-Demand for predictable, steady-state workloads like the 8 AM to 8 PM baseline. On-Demand instances then cover any unexpected spikes without requiring upfront commitment, ensuring cost optimization while maintaining capacity for the predictable load.

Answer

Use On-Demand instances for the baseline and Spot Instances for any additional capacity.

Answer

Use Dedicated Hosts for all instances to maximize cost savings.

Answer

Use Spot Instances for all instances to minimize costs.

Question 12

A company runs a production Amazon RDS for PostgreSQL DB instance in a single Availability Zone (AZ). The SysOps administrator needs to improve database availability so that in the event of a database failure or AZ outage, a standby instance is automatically promoted with minimal downtime. Which configuration should the administrator enable?

Accepted Answer

Enable Multi-AZ deployment on the DB instance.. Multi-AZ deployment automatically creates and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure or AZ outage, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, with no manual intervention required. This meets the requirement for automatic promotion with minimal downtime.

Answer

Enable automated backups with a retention period of 35 days.

Answer

Create a read replica in another Availability Zone.

Answer

Schedule manual snapshots to be taken every hour and restore from the latest snapshot when needed.

Question 13

A company wants to use Amazon CloudFront to serve content from an Application Load Balancer (ALB) that is internet-facing. Which type of origin should be configured in CloudFront?

Accepted Answer

Custom origin (HTTP/HTTPS) pointing to the ALB DNS name.. CloudFront requires a custom origin (HTTP/HTTPS) when the origin is an Application Load Balancer (ALB) because ALBs are not S3 buckets and do not support S3 origin configurations. The custom origin type allows CloudFront to forward requests to the ALB's public DNS name, which resolves to the ALB's IP addresses, enabling proper load balancing and content delivery.

Answer

S3 origin with the ALB's DNS name as the bucket name.

Answer

Custom origin with Origin Access Identity (OAI) to restrict access.

Answer

Custom origin pointing to the ALB's private IP address.

Question 14

A SysOps administrator maintains an AWS CloudFormation stack that deploys an Amazon EC2 instance. The administrator needs to change the instance type from t2.micro to t3.micro. The administrator wants to review the proposed changes before applying them to ensure no unexpected resource replacement occurs. Which CloudFormation feature should the administrator use?

Accepted Answer

Create a change set from the updated template, review the changes, and then execute the change set.. A change set allows the administrator to review the proposed modifications (including whether any resource replacement will occur) before applying them. By creating a change set from the updated template, the administrator can inspect the list of changes, such as the instance type update, and confirm that no unexpected resource replacement (e.g., a new EC2 instance being created) will happen. Only after reviewing the change set can the administrator safely execute it to apply the changes.

Answer

Use the AWS CloudFormation console to directly update the stack with the new instance type and monitor the events.

Answer

Use the AWS CloudFormation drift detection feature to check for differences between the stack and the template.

Answer

Modify the CloudFormation template locally and use the AWS CLI to validate it with 'aws cloudformation validate-template'.

Question 15

A company runs a stateful web application on a single Amazon EC2 instance. The application stores session state in memory and writes critical data to an Amazon EBS volume. The SysOps administrator needs to implement a highly available architecture that can tolerate an Availability Zone (AZ) failure. The administrator plans to use an Auto Scaling group and an Application Load Balancer (ALB). Which combination of steps is required to make the application highly available while preserving session and data durability across AZ failures?

Accepted Answer

Use an Auto Scaling group across multiple AZs, migrate session storage to Amazon ElastiCache (multi-AZ), and migrate application data from EBS to Amazon EFS (file system mounted across AZs).. It addresses both session state and data durability across AZ failures. Migrating session storage to ElastiCache (multi-AZ) ensures session data survives instance failure, and migrating application data from EBS to EFS provides a shared, multi-AZ file system that persists independently of any single EC2 instance. This combination allows the Auto Scaling group to launch new instances in any AZ and immediately access both session and application data.

Answer

Create an AMI of the current instance, configure an Auto Scaling group with a launch template that uses the AMI, and attach the existing EBS volume to new instances.

Answer

Create a multi-AZ Auto Scaling group and use sticky sessions (session affinity) on the ALB to tie users to specific instances.

Answer

Use an Auto Scaling group in a single AZ and use a Multi-AZ RDS instance for data storage.